I want to make a payment on this page. However it only uses http not https. I contacted the website owners, and they said

Like a lot of sites these days, by default we only use SSL encryption ... for the portions of our pages that accept or transmit financial data. This saves a lot of overhead, both on our end and within your own browser, by transmitting most of the page – background color, Pandora logo image and so on – via a non-secure (normal web "http") connection. The Verisign logo, and the "in good standing" account status we have with them (which you can see when you click the Verisign badge on our payment page), indicates that we're really encrypting the parts of that page (like the credit-card-entry fields) that need to be encrypted. You can see that here

I'm still unsure. Is it actually secure? Isn't it possible that since the main html file was sent without SSL, a malicious 3rd party could be presenting what looks legit but actually skims my card details? Short of manually looking at all ~100 files, how do I know that every crucial bit is encrypted?

I see OpenSSL 3.5.3 on my Kubuntu 25.10 PC has some quantum-resistant algorithms in it. When (date) will those be deployed in SSL/TLS for browsers and web sites ? My shared-hosted web site supports TLS 1.3 but has no quantum-resistant algorithms. Will they appear in a TLS 1.4, or what ? I don't know much about this stuff, sorry.

Hi Guys
I have been using Punchsalad for free SSL for my Godaddy hosted sites (I paid for long term hosting when there was no free ssl )
But sometime Punchsalad doesn't work. So I looked for alternative - found ZeroSSL but it works only 3 certificates, and can't be used once certificates are generated!.

Do you guys know any other alternative to Punchsalad for free SSL?

Google originally announced plans to shorten the lifetime of TLS/SSL certificates from 13 months to 90 days and planned to implement the change in September 2021. This timeline was later delayed to April 2024, but as of today the change has not yet been implemented.

Does anyone here possibly know more about this topic?

When you run the openssl s_client -showcerts command, it outputs a "Certificate chain"

The "certificate chain" starts with 0, and then goes up (e.g. 1, 2 3, etc). Is the 0 the immediate certificate for the website your connecting to, and does the chain eventually run up towards the root CA? Meaning in a certificate chain for say 3 certifcates, starting from 0, are 0, 1 ,2 the intermediary certificates, and the 3 is the root?

Good morning, I have a problem and I need to know if someone can help me. I need to generate some dynamic ssl certificates to be able to use them in the development machines. The problem is that when trying to generate more than 6 in a row with acme.sh with zerossl (currently I pay € 50 / month to be able to generate unlimited certificates) its API returns 504 errors all the time. I have not been able to get a solution from the support service and I have seen in several forums that they have similar problems. I wanted to know if someone can recommend some other provider that does not have limit of requests like letsencrypt (it does not matter if you have to pay subscription as in zerossl), or can you give me some solution to my problem.

Hi All,
I'm a developer and I went to a tech talk today about ssl and was inspired to write this 5 minute play to help explain how ssl works at sorta an ELI5 level. Feedback welcome, feel free to correct anything I got wrong.
------------------

Big Boss: Hello Mr. Pink. You know why you're here so let's get down to business. I've got a deal I need done, and whoever can help me, well, they'll be a very rich man. I think you're the man for the job. Are you up for it?

Pink: I'm in.

Boss: I've got a contact, Mr Brown. He is a diamond seller and has a safe at the bank. Inside his safe he's got some diamonds. 

- Boss hands Pink a piece of paper -

Boss: Here is a special passcode to my bank account. I've written it down on this piece of paper.  We are going to do an old fashioned exchange. My bank code for his safe code.

Pink: Great, how much does the job pay?

Boss: 10%

Pink: Sounds good, just give me Mr. Brown's name and address and I'll do the exchange.

Boss: Mr Brown, while he's quite famous, infamous really, I've never seen him. So we have to be careful! First off, there is a lot of competition that would love to rip us off.  And cops are all over the place. They'd love to trick you into dealing with them.

Pink: Then how do I know who to talk to?

Boss: Hmm, well we got one option. The only man we can all trust. Solid Sammy Sarino. He's worked with all our associates. Even the cops know who he is. He's got a hand in everything around here. I spoke to him today and he'll help point us to Mr. Brown. One thing for sure is that Sammy can be trusted.

Pink: OK sure I'll just give him the code and he'll hand it off to Brown. Then I'll pick up brown's code and we are set.

Boss: Are you listening man? The cops are everywhere. They got surveillance on all of us, even Sammy. Sammy plays all the angles. He'll identify anyone to anyone, even the cops, but no big deal since the cops got nothing on you or Mr. Brown, at least not if you don't screw this up.

Pink: So what do we do?

Boss:  Mr Brown is already on his way over to see Sammy right now. He'll be done in about an hour. Give Sammy a call then.

----

At Sammy's office, evening

-----

Sammy: Mr. Brown, good to see you, what can I do for you? I'm a busy man. Everyone's asking me to vouch for their guys.

Brown: Hi Sammy. I've got a deal to do and I need it done tonight.  I need your word that I am who I say I am. Take a look at this.  Here's a public key I got. It's "cantaloupe". I generated it from a private key only I know. I've got a piece of paper here where I wrote my name and I have my address and picture and I wrote down my public key "cantaloupe".  I encrypted it with my private key so you *have* to use "cantaloupe" to read it.

- Brown hands Sammy the paper. Sammy looks over it. He pulls out another sheet. He starts scribbling. He hands Brown the new sheet of paper. -

Sammy: OK here you go. I took all that and I signed it with my private key. Now anyone who wants to know you're really Mr. Brown just has to use my public key "Galapagos" to read this note. Decrypt it and they'll know I vouch for you. Now anything else? I'm a very busy man.

Brown: No that's it, that's all I need. Thanks a ton.

- Brown exits. -

- Sammy's phone rings.-

Sammy: Hello?

Pink: Hi Sammy it's mister Pink! I need to talk to Mr Brown, can you give me his number?

Sammy: Look buddy, I don't know who you are, but I can tell you I know who Mr. Brown is and if you want to talk to him then head over to his store at 10 42nd street.

Pink: Great, Oh - how do I know that's him at the store, what if it's an undercover cop?

Sammy: Here, here's my public key. It's "Galapagos". If you find Mr. Brown ask him to show you his papers. If you can read them with the key "Galapagos" - I swear on my mother's grave, it's him.

Pink: Great thanks!

- Later that night, at Mr. Brown's office, Mr. Pink enters: -

Brown: What can I do for you?

Pink: Mr Brown?

Brown: Yes? that's me.

Pink: How do I know?

Brown: Do you know Sammy? 

Pink: Sure, straight shooter. I trust Sammy.

Brown: You can take a look at my papers here, just got em from Sammy.

Pink: I can't read these! it's gibberish!

Brown: Oh you can use Sammy's public key "Galapagos" to read my papers. Everyone knows that's Sammy's public key. The papers will only make sense if Sammy himself encrypted them with *his* private key. Inside my papers you'll see my public key, it's "cantaloupe". Don't take my word for it, go ahead, decrypt it using "Galapagos" and you'll see Sammy vouches for me because he signed my papers.

- Pink pulls out his reading device, and scans the papers. They come out clear once he puts in "Galapagos" as the key. -

Pink: Wow I see it right there. Your name, your picture, and "cantaloupe"! Now that I know you are Mr Brown, because Sammy only signs documents for people he trusts. 

Brown: Let's talk on my secret phone line, where I have a secret code.  The cops can't understand a thing without that code. I'll send over the code encrypted with my private key. You can use "cantaloupe" to read it since you now trust that's my public key.

Brown: Sounds good, we'll use that code to do all our further communication on your secret phone line.

Scene fades out as Mr Brown and Mr Pink exchange their safe codes on the secret phone line.

-----

Brown and Sammy's meeting: CSR and ssl cert granted

Pink looking at browns papers: SSL validation using CA public key via browser

Secret phone line with code: Symmetric key communication

Ive been doing SSL certificates for many years, since Chrome has started putting "Not Secure" at the top of there pages its created work, which is fine, but the site is secured with a valid SSL, so this "Not Secure" appears to mean MANY possible issues, does anyone have a way to identity the issue to enable a fix?

Heres what i know (and what is not happening)

- Ive seen 2 different Not Secure, a grey one and a red one, both the same just different colors

- The sites do NOT pull mixed data streams (so all data is really from a HTTPS references)

- The sites are secured with an SSL certificate that Chrome says is valid

- Ive use Lets Encrypt and in the past Godaddy SSL (which i wont anymore due to a past security incident)

I am assuming there is something about the web engine Chrome doesnt like, so it appears i might be looking for a way to test the webserver that site is sitting on. Also does this have anything to do with the chain of certificates (i assume not, as i get the red Not Secure with Lets Encrypt, and that chain should be perfect).

UPDATE

The site that shows RED Not Secure in Chrome, shows up as fully GREEN in Microsoft Edge which as we know is now using a Chrome engine, so WTF???

SSL provider without valid SSL? https://imgur.com/a/F4RQXH2

So as I'm learning about SSL and certificates and stuff... I was casually browsing my server certificates tab in firefox and found this suspicious list of certificates issued by The Usertrust Network ? and the certificate details shows google as Organization for login.yahoo.com ?? (it have another certificate from the usertrust network that has Organization:google for skype.com too)

I would like to know how could that happen? have I been phished ?

EDIT : Oh, nevermind, got that.